AlertINT turns infrastructure alerts into investigated incidents and serves them to the AI tools you already use, over MCP — a self-hosted agent that runs inside your own network.

A single Go binary that sits between your monitoring stack and your AI agent. It ingests alert webhooks from Alertmanager and Zabbix, correlates them into incidents through an open rule engine, and runs an LLM triage that falsifies its own draft verdict before the finding ships. Findings go to Slack; the incident state — plus read-only Prometheus, Loki, and Zabbix access — is exposed to any MCP client. Corrections your agent captures over MCP steer the next triage of the same failure. Read-only by design. Local state. You bring the LLM key.

Full documentation: alertint.com/docs

Get started

The Quickstart is the canonical walkthrough — install (single binary or bundled Docker Compose stack), configure, and prove the whole pipeline with one command:

alertint drill --config config.yaml

The built-in incident drill plants a fake deploy, fires a burst of clearly-marked synthetic alerts through the production ingress, and polls until triage prints the finding — a causal analysis naming the planted deploy. From zero to that finding takes about ten minutes; then connect an MCP client to investigate it, and point Alertmanager or Zabbix at the agent for real alerts.

How it works

Two loops close on the triage step: the verification round gathers evidence chosen to disprove the model's own draft and makes it re-judge before anything persists, and an operator correction captured over MCP lands in incident memory, where it steers the next triage of that failure group.

The whole pipeline — receivers, correlation, the evidence pack, both loops, and the MCP surface — is diagrammed and walked through step by step in Architecture.

Documentation

The /docs folder in this repo is the canonical source for those pages — the website renders it at build time. Documentation PRs are welcome here; see docs/README.md and CONTRIBUTING.md.

License

AlertINT is Fair Source, licensed under FSL-1.1-ALv2 (Functional Source License). Free to read, use, modify, and self-host at any scale. The only restriction is offering the software to others as a competing commercial product or service. Each release converts to Apache 2.0 — full open source — two years after publication. See fsl.software for the license text.